MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29d4deb5d70710e62b9680856c1ea104aeec5921bd8f917b21c4a74bd3f22868. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SilentNet

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	29d4deb5d70710e62b9680856c1ea104aeec5921bd8f917b21c4a74bd3f22868
SHA3-384 hash:	d57cf116eb2bf22ba0eb6c2bbc1cd0922298a5f873cd53f6911bfee06f355e1748329aeae44c68f470c99483eb1c4d89
SHA1 hash:	c4dbec6ee7899621309f332cfb6e328286e50c4d
MD5 hash:	db5103a4231d77b8aa9895504f764873
humanhash:	pizza-kansas-twelve-item
File name:	DQRKIS_CURRENT-donutsmpclients-store.jar
Download:	download sample
Signature	SilentNet Create hunting rule
File size:	1'564'038 bytes
First seen:	2026-10-22 14:57:55 UTC
Last seen:	Never
File type:	jar
MIME type:	application/java-archive
ssdeep	24576:rU0o14GedZvqx65KOBG7oaQMPxf2DV0LJYPNJzaaAvQAgtdCeBY+niMN5:rfZvK65KOwoJMJeDV0LJYFJza7vhQdCa
TLSH	T17275AF17D10F6475F127A33641712F25B93CC69AEB0AA5BB2EF84C868CE19C70F49396
TrID	57.8% (.JAR) Minecraft Fabric Mod (24020/2/4) 32.5% (.JAR) Java Archive (13500/1/2) 9.6% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	GhostTypes
Tags:	jar SilentNet stealer

GhostTypes

SilentNet sn-loader-v3 fake Minecraft client jar, pulled 2026-10-22 from donutsmpclients.store (storefront front donutsmp-clients.com, domain reg 2026-10-13; reached via TikTok promo funnel, @vwebx bioLink). Static analysis (bbmmd): 2139 classes; allatori-interleave string encryption (82 decrypted strings); char-compose fold resolves C2 dead-drop contract 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a (selector 0xce6d41de) read via 5-mirror Polygon RPC fleet (polygon.drpc.org, polygon-bor-rpc.publicnode.com, 1rpc.io/matic, api.zan.top, rpc-mainnet.matic.quiknode.pro); on-chain fallback thisisafalsepositive.st; beacon path /shard/prefireMc; campaign-uuid 8c06a480-a016-4da6-9a44-b6d6bfaf1a68; persistence markers 'install Microsoft' / 'install NtProfileIndex'. Kit fingerprints: dropper-g1:char-dense, allatori:pool-decrypt, sn-loader-v3:char-compose. Same contract+UUID across all nine storefront jars (sibling Goobaa 11e4d3ce… already on MB by wok).

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

jar

Verdict:

Malicious activity

Analysis date:

2026-10-22 14:58:53 UTC

Tags:

silentnet stealer etherhiding evasion auto python generic arch-exec arch-doc openssl tool

Link:

https://app.any.run/tasks/722c3e58-34ee-46b2-b6ab-d17183d329ee

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/94130/

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ada2489afb06e650cd8b46a

Tags:

n/a

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ada2487297beb531ab26c2a/reports/c054b3b9-d38e-448d-b027-f9717fb86d52/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/29d4deb5d70710e62b9680856c1ea104aeec5921bd8f917b21c4a74bd3f22868

Verdict:

Unknown

File Type:

jar

Link:

https://opentip.kaspersky.com/29d4deb5d70710e62b9680856c1ea104aeec5921bd8f917b21c4a74bd3f22868/results?tab=lookup

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261022-sb9qmsds2v/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/29d4deb5d70710e62b9680856c1ea104aeec5921bd8f917b21c4a74bd3f22868

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SilentNet_FakeFabric_Jar_Container Create hunting rule
Author:	NyxIndius
Description:	Detects fake Fabric mod JAR with net/fabric/ package (not net/fabricmc/) and random class names, associated with SilentNet loader/stealer